hamedandClaude Opus 5
2e0888e0ef
Phase 3 of the tenant-marking series. The same concept was written four ways, and the Doctrine filter arriving in phase 4 keys on the field name — so the tables using a different spelling would have been skipped silently, which is exactly the leak this work exists to prevent. - discount_rules: owner_type/owner_id renamed to entity_type/entity_id. Pure rename, no data moves. - doctor_secretaries: owner_type plus a nullable clinic_id replaced by the shared pair. The environment now comes from the clinic argument alone, so the inconsistent combination (owner_type='clinic', clinic_id=NULL) can no longer be constructed, and the redundant constructor parameter is gone. - user_active_context: added db_type, so resolving an environment is one lookup instead of "try clinics, then try doctors". Filled from the type already present in available_contexts. - entity_type is VARCHAR(10) in all twenty tenant tables; four of them were 20. Behaviour change, the only one in this series: the doctor_secretaries unique key went from (doctor_id, secretary_id, owner_type) to (doctor_id, secretary_id, entity_type, entity_id). With clinic_id outside the key, one secretary could not be assigned to the same doctor in two clinics — the second row collided on owner_type='clinic'. The duplicate check in SecretaryController had the same blind spot and would have rejected the request before the database saw it; both are fixed together. Correcting an assumption from the phase-3 plan: mobile_verification_otp.entity_type really is a tenant pair. NotificationMobileController validates the target against ['doctor','clinic'] and stores that entity's id, so the column was normalised with the rest rather than treated as unrelated. TenantOwnedTrait gained assignTenantPair() for callers that resolved the pair as scalars and hold no entity — building an EntityContext from scalars would produce one where isClinic() is true but ->clinic is null, breaking consumers silently. tests/ApiTestCase::createUser now retries on a duplicate mobile. db_test is never reset and already holds ~38k users, so the 9-digit random draw collided often enough to fail unrelated tests a few percent of runs. Tests: 830 passing. PHPStan reports no new errors on the changed files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
318 lines
13 KiB
PHP
318 lines
13 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Secretary;
|
|
|
|
use App\Auth\Entity\UserActiveContext;
|
|
use App\Clinic\Entity\Clinic;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Secretary\Entity\DoctorSecretary;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* A secretary's per-resource permission JSON (DoctorSecretary.permission) must be
|
|
* enforced by the API, not only for appointments. Resources the secretary was not
|
|
* granted return 403; granted ones pass.
|
|
*/
|
|
class SecretaryResourceEnforcementTest extends ApiTestCase
|
|
{
|
|
private function makeClinicSecretary(): array
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
|
|
$this->em->persist($doctor);
|
|
$clinic->getDoctors()->add($doctor);
|
|
|
|
$secretary = $this->createUser(['ROLE_SECRETARY']);
|
|
$rel = new DoctorSecretary($doctor, $secretary, $clinic);
|
|
$this->em->persist($rel);
|
|
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid(), 'clinic'));
|
|
|
|
return [$secretary, $rel];
|
|
}
|
|
|
|
public function testInventoryDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: inventory.* = false
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testInventoryAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['inventory' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testPatientCreateDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: patients.create = false (view is true)
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('POST', '/api/v1/patient', $secretary, ['name' => 'x']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testInventoryCreateDeniedButViewGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['inventory' => ['view' => true, 'create' => false]]]);
|
|
$this->em->flush();
|
|
|
|
// مشاهده مجاز
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
// ایجاد ممنوع
|
|
$this->authJson('POST', '/api/v1/inventory-item', $secretary, ['name' => 'گاز استریل']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
// service-items (listAllItems) فقط توگلِ permission را میسنجد — برخلاف
|
|
// service-sections که پیش از آن، گیتِ اشتراک (assertServicesGate) هم دارد.
|
|
public function testServicesDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: services.* = false
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testServicesAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testServicesCreateDeniedButViewGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true, 'create' => false]]]);
|
|
$this->em->flush();
|
|
|
|
// مشاهده مجاز
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
// ایجاد ممنوع — گیتِ permission پیش از گیتِ اشتراک اجرا میشود.
|
|
$this->authJson('POST', '/api/v1/service-section', $secretary, ['name' => 'بخش تست']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
// ── Phase B resources ─────────────────────────────────────────────────────
|
|
|
|
public function testStaffDeniedByDefault(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/staff', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testStaffAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['staff' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/staff', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testStaffCreateDeniedButViewGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['staff' => ['view' => true, 'create' => false]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/staff', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
$this->authJson('POST', '/api/v1/staff', $secretary, ['full_name' => 'خانم تست']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testDiscountsDeniedByDefault(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/admin/discount-rules', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testDiscountsAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['discounts' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/admin/discount-rules', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testSmsDeniedByDefault(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/sms/wallet/balance', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testSmsAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['sms' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/sms/wallet/balance', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testClinicDoctorsDeniedByDefault(): void
|
|
{
|
|
[$secretary, , $clinic] = $this->makeClinicSecretaryWithClinic();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', "/api/v1/admin/clinic/{$clinic->getUuid()}/doctor-permissions", $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testClinicDoctorsAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel, $clinic] = $this->makeClinicSecretaryWithClinic();
|
|
$rel->mergePermissions(['resources' => ['clinic_doctors' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', "/api/v1/admin/clinic/{$clinic->getUuid()}/doctor-permissions", $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testAppointmentSettingsDeniedByDefault(): void
|
|
{
|
|
[$secretary, , $clinic, $doctor] = $this->makeClinicSecretaryWithClinic();
|
|
$this->em->flush();
|
|
|
|
// clinic_uuid لازم است تا محیطِ کلینیک حل شود (مثل پزشکِ عضو کلینیک).
|
|
$this->authJson('GET', "/api/v1/appointment-settings/holidays/list/{$doctor->getUuid()}?clinic_uuid={$clinic->getUuid()}", $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testAppointmentSettingsAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel, $clinic, $doctor] = $this->makeClinicSecretaryWithClinic();
|
|
$rel->mergePermissions(['resources' => ['appointment_settings' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', "/api/v1/appointment-settings/holidays/list/{$doctor->getUuid()}?clinic_uuid={$clinic->getUuid()}", $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testSubscriptionDeniedByDefault(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/subscription/my', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testSubscriptionAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['subscription' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/subscription/my', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testPatientDeleteSeparateFromUpdate(): void
|
|
{
|
|
// منشی با patients.update ولی بدون patients.delete نباید بتواند حذف کند.
|
|
// گیتِ delete پیش از واکشیِ رکورد اجرا میشود، پس uuidِ ناموجود هم ۴۰۳ میدهد.
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['patients' => ['view' => true, 'update' => true, 'delete' => false]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('DELETE', '/api/v1/patient/note/00000000-0000-0000-0000-000000000000', $secretary);
|
|
$this->assertSame(403, $this->responseCode(), 'حذف باید جدا از ویرایش کنترل شود');
|
|
}
|
|
|
|
public function testPatientDeleteAllowedWhenGranted(): void
|
|
{
|
|
// با patients.delete، گیت عبور میکند و به «یافت نشد» میرسد (نه ۴۰۳).
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['patients' => ['view' => true, 'delete' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('DELETE', '/api/v1/patient/note/00000000-0000-0000-0000-000000000000', $secretary);
|
|
$this->assertSame(404, $this->responseCode());
|
|
}
|
|
|
|
public function testDoctorListReturnsOnlyAssignedDoctors(): void
|
|
{
|
|
// کلینیک با دو پزشک؛ منشی فقط به یکی تخصیص داده شده.
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$assigned = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تخصیصیافته');
|
|
$unassigned = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر دیگر');
|
|
$this->em->persist($assigned);
|
|
$this->em->persist($unassigned);
|
|
$clinic->getDoctors()->add($assigned);
|
|
$clinic->getDoctors()->add($unassigned);
|
|
|
|
$secretary = $this->createUser(['ROLE_SECRETARY']);
|
|
$this->em->persist(new DoctorSecretary($assigned, $secretary, $clinic));
|
|
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid(), 'clinic'));
|
|
$this->em->flush();
|
|
|
|
// اندپوینتِ احرازشدهٔ پنل (نه /clinic/doctor-list که عمومی است).
|
|
$body = $this->authJson('GET', '/api/v1/my/clinic-doctors', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
$names = array_map(static fn($d) => $d['name'], $body['data']['data']);
|
|
$this->assertContains('دکتر تخصیصیافته', $names);
|
|
$this->assertNotContains('دکتر دیگر', $names, 'منشی نباید پزشکِ تخصیصنیافته را ببیند');
|
|
}
|
|
|
|
/** مثل makeClinicSecretary اما clinic و doctor را هم برمیگرداند. */
|
|
private function makeClinicSecretaryWithClinic(): array
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
|
|
$this->em->persist($doctor);
|
|
$clinic->getDoctors()->add($doctor);
|
|
|
|
$secretary = $this->createUser(['ROLE_SECRETARY']);
|
|
$rel = new DoctorSecretary($doctor, $secretary, $clinic);
|
|
$this->em->persist($rel);
|
|
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid(), 'clinic'));
|
|
|
|
return [$secretary, $rel, $clinic, $doctor];
|
|
}
|
|
}
|